This article teaches IP addressing and subnetting fundamentals for ethical hackers, moving from practical motivation to technical mechanics. Rather than abstract math, it grounds subnetting in real penetration testing scenarios—scan scoping, network diagram interpretation, bug bounty scope definition, and lateral movement planning. Mastering this material enables hackers to instantly understand network ranges, calculate target hosts, and recognize network segmentation patterns during assessments.
- Why hackers must understand /24 notationThe article opens with a critical observation: most beginners type CIDR notation (like 192.168.1.0/24) without understanding it, relying on tutorials rather than comprehension. When scans fail or produce unexpected results, they have no foundation for troubleshooting. Understanding the notation prevents accidental over-scanning (entire internet) or under-scanning (missing live targets) and enables reading network topology diagrams used in penetration test reports.
- IPv4 structure divides into network and host portionsAn IPv4 address is a 32-bit number split into four 8-bit octets (values 0–255 each), totaling 4.3 billion possible addresses. Each address contains two logical parts: the network portion (which network the device belongs to) and the host portion (which specific device). The subnet mask defines the dividing line between these portions by using 1 bits for network and 0 bits for host.
- Subnet masks follow strict binary pattern rulesA valid subnet mask must consist of a continuous string of 1 bits followed by a continuous string of 0 bits—never mixed (e.g., 11111111.11111111.11111111.00000000 is valid; 11110101.00001111.11110000.10101010 is not). The 1 bits define which portion of the IP address identifies the network (locked—same for all hosts), and the 0 bits define the host portion (variable across devices).
- CIDR notation compresses subnet mask representationCIDR (Classless Inter-Domain Routing) simply counts the number of 1 bits in the binary subnet mask and appends that count after a slash. For example, 255.255.255.0 has 24 consecutive 1 bits, so it becomes /24; 255.255.0.0 with 16 ones becomes /16. This allows 192.168.1.0/24 to express both network address and subnet mask in compressed form.
- Universal formula calculates any subnet sizeGiven a CIDR prefix, three calculations answer essential questions: Host bits = 32 minus CIDR prefix; Total addresses = 2 to the power of host bits; Usable hosts = Total addresses minus 2 (removing network and broadcast addresses). For example, /24 yields 8 host bits, 256 total addresses, and 254 usable hosts; /30 (point-to-point links) yields 2 host bits, 4 total addresses, and only 2 usable hosts.
- Common subnets appear repeatedly in real workThe article provides a reference table of subnets encountered in 90% of assessments: /24 (254 hosts—most common lab default), /16 (65,534 hosts—large enterprises), /8 (16+ million—ISPs), /26-/28 (server clusters and floor subnets), and /30 (2 hosts—router-to-router links). A mental shortcut shows each CIDR step down doubles host count: /24 has 254 hosts while /23 has 510.
- Tools automate calculations but understanding is essentialThe article emphasizes using ipcalc, ip route, and nmap CIDR notation for speed while retaining conceptual knowledge. For example, ipcalc 192.168.1.0/24 instantly displays network address, host range, broadcast address, and host count. However, the article stresses that understanding the concepts remains mandatory—tools assist professionals who already grasp the mechanics.
- Real pentests reveal subnetting through five stagesThe article walks through an internal network pentest scenario demonstrating subnetting in practice: Stage 1 scopes a 10.10.0.0/16 network (65,534 hosts), Stage 2 runs host discovery on /24 segments to identify live systems, Stage 3 enumerates services and recognizes same-subnet targets require no router hop, Stage 4 pivots to a different /24 segment found on a compromised host's routing table, and Stage 5 identifies poor network segmentation as a finding because different functional subnets (workstations vs. databases) can reach each other directly.
Bottom line: Subnetting is not abstract math—it is the operational foundation for every scan range, network diagram interpretation, and lateral movement decision in ethical hacking work. Mastering the binary-to-CIDR conversion and host range calculation enables instant tactical decisions during penetration tests without relying on calculators or tutorials.
Day 100 — Professional Pentester
I’m going to be direct about subnetting: it has a reputation for being the topic that breaks beginners. That reputation exists because most teachers jump straight into the math without explaining why any of it matters. I’m going to do the opposite — purpose first, mechanics second. By the end of today you’ll understand subnetting well enough to calculate target ranges in your head for common networks.
Why Subnetting Matters — The Hacker’s Perspective
Before we touch any math, I want you to understand exactly where subnetting shows up in practical ethical hacking work. This context will make the technical details meaningful rather than abstract.
nmap 10.10.10.0/24, you need to know what that /24 means — 254 potential hosts on that network segment. Understanding this prevents you from accidentally scanning too broad (entire internet) or too narrow (missing live hosts).IPv4 Address Structure — Anatomy of an IP
An IPv4 address is a 32-bit number written in a human-readable format called dotted decimal notation. The 32 bits are split into four groups of 8 bits (called octets), each converted to a decimal number between 0 and 255, separated by dots.
Every IP address has two parts: the network portion (which network does this belong to?) and the host portion (which specific device on that network?). The subnet mask tells you where the dividing line falls between these two parts.
Binary — Just Enough to Understand Subnetting
I’m not going to teach you to think in binary. I’m going to give you the one table you need, and the one concept that makes subnet masks immediately clear. That’s all the binary you need for subnetting.
11111111.11111111.11111111.00000000 is valid. 11110101.00001111.11110000.10101010 is not a valid subnet mask. This single rule explains everything about how subnet masks work.Subnet Masks Demystified — What They’re Actually Telling You
A subnet mask is a 32-bit number that tells you which part of an IP address is the network portion (the 1 bits) and which part is the host portion (the 0 bits). Every device on a network has both an IP address and a subnet mask — together they define what network the device belongs to.
Identifies the subnet itself
Assigned to devices
Sends to all devices
CIDR Notation — The Shorthand That Appears Everywhere
Writing out 255.255.255.0 every time is clunky. CIDR (Classless Inter-Domain Routing) notation solves this by just counting the number of 1 bits in the mask and appending that count after a slash. It’s a compressed way to express both the network address and the subnet mask together.
Calculating Host Ranges — The Formula That Always Works
Given a CIDR notation, you need to be able to answer three questions instantly: How many addresses are in this subnet? What is the first usable host? What is the last usable host? Here is the formula and examples for the most common subnets you’ll encounter.
📋 Common Subnets — The Cheat Sheet You’ll Actually Use
These are the subnet sizes you’ll encounter 90% of the time in real assessments, CTFs, and lab environments. Bookmark this table — it will save you calculation time on every engagement.
| CIDR | Subnet Mask | Usable Hosts | Typical Use | Hacker Note |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,214 | Large ISPs, Class A | Very large — scan only specific /24s within |
| /16 | 255.255.0.0 | 65,534 | Corporate networks | Large enterprises — scan /24 segments |
| /24 | 255.255.255.0 | 254 | Home/small office | Most common — your lab default |
| /25 | 255.255.255.128 | 126 | /24 split in half | Hosts: .1–.126 and .129–.254 |
| /26 | 255.255.255.192 | 62 | /24 split in 4 | Small segments, floor subnets |
| /27 | 255.255.255.224 | 30 | Small departments | Common in DMZ networks |
| /28 | 255.255.255.240 | 14 | Very small segments | Server clusters, management VLANs |
| /30 | 255.255.255.252 | 2 | Router links | Point-to-point links between routers |
| /32 | 255.255.255.255 | 1 (host only) | Single host route | nmap 10.10.10.5/32 = scan one IP |
Tools — Let the Machine Do the Maths
Understanding the concepts is essential. Using tools for speed is professional. These are the subnet tools every pentester keeps in their workflow — none require internet access once installed, and all are either pre-installed on Kali or one apt install away.
Subnetting for beginners in Real Assessments — How This Plays Out
Let me walk you through how subnetting knowledge actually shows up during a real penetration test — from scope definition to scanning to lateral movement. This is the unified picture of why everything we covered today matters.
nmap -sn 10.10.1.0/24 finds 23 live hosts. You check ip route — you’re on 10.10.1.0/24. All 23 hosts are directly reachable at Layer 2.🎯 Day 6 Practical Task
ip a # note your IP and CIDR
ipcalc <your-ip>/<cidr>
nmap -sn 192.168.56.0/24
# replace with your actual network range
10.0.0.0/8 → _____ hosts?
172.16.0.0/16 → _____ hosts?
192.168.1.0/28 → _____ hosts?
# Then verify:
ipcalc 10.0.0.0/8
ipcalc 172.16.0.0/16
ipcalc 192.168.1.0/28
netstat -rn
A client tells you their web server is at 203.0.113.65/26. Without using ipcalc: What is the network address? What is the broadcast address? What is the full range of usable hosts? Is 203.0.113.100 in the same subnet? Work it out using the formula — then verify with ipcalc. Save your working in your notes 🧮
And now every scan you run means something.
Six days in — the foundation is solid. Day 7 is where we first see network traffic with our own eyes: Wireshark. We’ll capture live packets, filter them, read HTTP in cleartext, and understand exactly what an attacker sees when they intercept traffic on a network. It’s one of the most visually striking things we’ll do in this course.
Frequently Asked Questions — Day 6 Subnetting for Beginners
Subnetting is the one topic students thank me for later — not during. When you first see it, it feels abstract. Six months from now, when you’re defining scan targets for a real engagement and you immediately know that /26 means 62 hosts, you’ll know exactly why today’s lesson was worth the effort.
